Skip to content

chore(deps): bump dependencies with 3 updates#1598

Merged
julien-deramond merged 1 commit intomainfrom
dependabot/npm_and_yarn/github-actions-0a8d769afd
Apr 20, 2026
Merged

chore(deps): bump dependencies with 3 updates#1598
julien-deramond merged 1 commit intomainfrom
dependabot/npm_and_yarn/github-actions-0a8d769afd

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Apr 20, 2026

Bumps the github-actions group with 3 updates: astro, astro-og-canvas and vercel.

Updates astro from 6.1.7 to 6.1.8

Release notes

Sourced from astro's releases.

[email protected]

Patch Changes

  • #16367 a6866a7 Thanks @​ematipico! - Fixes an issue where build output files could contain special characters (!, ~, {, }) in their names, causing deploy failures on platforms like Netlify.

  • #16381 217c5b3 Thanks @​ematipico! - Slightly improved the performance of the dev server by caching the internal crawling of the dependencies of a project.

  • #16348 7d26cd7 Thanks @​ocavue! - Fixes a bug where emitted assets during a client build would contain always fresh, new hashes in their name. Now the build should be more stable.

  • #16317 d012bfe Thanks @​das-peter! - Fixes a bug where allowedDomains weren't correctly propagated when using the development server.

  • #16379 5a84551 Thanks @​martrapp! - Improves Vue scoped style handling in DEV mode during client router navigation.

  • #16317 d012bfe Thanks @​das-peter! - Adds tests to verify settings are properly propagated when using the development server.

  • #16282 5b0fdaa Thanks @​jmurty! - Fixes build errors on platforms with skew protection enabled (e.g. Vercel, Netlify) for inter-chunk Javascript using dynamic imports

  • Updated dependencies [e0b240e]:

    • @​astrojs/telemetry@​3.3.1
Changelog

Sourced from astro's changelog.

6.1.8

Patch Changes

  • #16367 a6866a7 Thanks @​ematipico! - Fixes an issue where build output files could contain special characters (!, ~, {, }) in their names, causing deploy failures on platforms like Netlify.

  • #16381 217c5b3 Thanks @​ematipico! - Slightly improved the performance of the dev server by caching the internal crawling of the dependencies of a project.

  • #16348 7d26cd7 Thanks @​ocavue! - Fixes a bug where emitted assets during a client build would contain always fresh, new hashes in their name. Now the build should be more stable.

  • #16317 d012bfe Thanks @​das-peter! - Fixes a bug where allowedDomains weren't correctly propagated when using the development server.

  • #16379 5a84551 Thanks @​martrapp! - Improves Vue scoped style handling in DEV mode during client router navigation.

  • #16317 d012bfe Thanks @​das-peter! - Adds tests to verify settings are properly propagated when using the development server.

  • #16282 5b0fdaa Thanks @​jmurty! - Fixes build errors on platforms with skew protection enabled (e.g. Vercel, Netlify) for inter-chunk Javascript using dynamic imports

  • Updated dependencies [e0b240e]:

    • @​astrojs/telemetry@​3.3.1
Commits

Updates astro-og-canvas from 0.11.0 to 0.11.1

Release notes

Sourced from astro-og-canvas's releases.

[email protected]

Patch Changes

Changelog

Sourced from astro-og-canvas's changelog.

0.11.1

Patch Changes

Commits

Updates vercel from 51.6.1 to 51.8.0

Release notes

Sourced from vercel's releases.

[email protected]

Minor Changes

  • vercel env add now defaults Environment Variables to sensitive on Production and Preview. Sensitive values are encrypted at rest and cannot be retrieved later via the dashboard or CLI; they are still resolved for builds, deployments, vercel env pull, and runtime. (#16041)

    Behavior per target:

    • Production or Preview: defaults to sensitive. Pass --no-sensitive to opt back in to the previous encrypted behavior (value remains readable later).
    • Development: always stored as encrypted (sensitive is not supported by the Vercel API for Development). Passing --sensitive alongside a Development target now errors up-front instead of silently falling back.
    • Mixed selection (e.g., interactive checkbox picks production + preview + development): errors and asks you to run vercel env add separately for Development, because Development cannot share a record type with Production/Preview.

    Flag summary:

    • --sensitive: unchanged in meaning (request a sensitive variable); now errors when combined with Development.
    • --no-sensitive: new; opt out of the new default for Production/Preview.
    • --sensitive --no-sensitive together: errors.

    On teams that enable the "Enforce Sensitive Environment Variables" policy in team settings, the CLI now reads the policy from the team object and notes in the output that the policy is active; the server already promotes Production/Preview variables to sensitive silently, and the CLI's own logs are now honest about it. Passing --no-sensitive on a policy-on team for Production/Preview now emits a warning — the flag is a no-op because the server promotes the variable regardless — and the CLI sends type: 'sensitive' so its own --debug output matches what gets stored.

Patch Changes

[email protected]

Minor Changes

  • [detect-services] If a vercel.toml exists, update the vercel.toml (#15895)

  • Use correct filename in messages when config file is not vercel.json (#15893)

  • [services] move Python workers to v2beta triggers with private routing (#15920)

... (truncated)

Changelog

Sourced from vercel's changelog.

51.8.0

Minor Changes

  • vercel env add now defaults Environment Variables to sensitive on Production and Preview. Sensitive values are encrypted at rest and cannot be retrieved later via the dashboard or CLI; they are still resolved for builds, deployments, vercel env pull, and runtime. (#16041)

    Behavior per target:

    • Production or Preview: defaults to sensitive. Pass --no-sensitive to opt back in to the previous encrypted behavior (value remains readable later).
    • Development: always stored as encrypted (sensitive is not supported by the Vercel API for Development). Passing --sensitive alongside a Development target now errors up-front instead of silently falling back.
    • Mixed selection (e.g., interactive checkbox picks production + preview + development): errors and asks you to run vercel env add separately for Development, because Development cannot share a record type with Production/Preview.

    Flag summary:

    • --sensitive: unchanged in meaning (request a sensitive variable); now errors when combined with Development.
    • --no-sensitive: new; opt out of the new default for Production/Preview.
    • --sensitive --no-sensitive together: errors.

    On teams that enable the "Enforce Sensitive Environment Variables" policy in team settings, the CLI now reads the policy from the team object and notes in the output that the policy is active; the server already promotes Production/Preview variables to sensitive silently, and the CLI's own logs are now honest about it. Passing --no-sensitive on a policy-on team for Production/Preview now emits a warning — the flag is a no-op because the server promotes the variable regardless — and the CLI sends type: 'sensitive' so its own --debug output matches what gets stored.

Patch Changes

51.7.0

Minor Changes

  • [detect-services] If a vercel.toml exists, update the vercel.toml (#15895)

  • Use correct filename in messages when config file is not vercel.json (#15893)

... (truncated)

Commits
  • 670553a Version Packages (#16046)
  • 193c515 feat(cli): env add sensitive by default for Production and Preview (#16041)
  • 5df9328 Version Packages (#16024)
  • 3c17e8b Use correct filename in messages when config file is not vercel.json (#15893)
  • 0dcf4a9 [detect-services] If a vercel.toml exists, update the vercel.toml (#15895)
  • 0793b7d [services] move Python workers to v2beta triggers with private routing (#15920)
  • 3431dae feat(cli): use POST for connex create with browser registration fallback (#16...
  • aef5dc9 fix: firewall CLI bug bash fixes (#15985)
  • 665c350 [CLI] Bubble up action + resource from 403 errors to agent output (#15940)
  • 4a164c6 feat(cli): add table formatting for OpenAPI responses (#16011)
  • See full diff in compare view
Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for vercel since your current version.


Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the github-actions group with 3 updates
810a489 
Bumps the github-actions group with 3 updates: [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro), [astro-og-canvas](https://github.com/delucis/astro-og-canvas/tree/HEAD/packages/astro-og-canvas) and [vercel](https://github.com/vercel/vercel/tree/HEAD/packages/cli).


Updates `astro` from 6.1.7 to 6.1.8
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/[email protected]/packages/astro)

Updates `astro-og-canvas` from 0.11.0 to 0.11.1
- [Release notes](https://github.com/delucis/astro-og-canvas/releases)
- [Changelog](https://github.com/delucis/astro-og-canvas/blob/latest/packages/astro-og-canvas/CHANGELOG.md)
- [Commits](https://github.com/delucis/astro-og-canvas/commits/[email protected]/packages/astro-og-canvas)

Updates `vercel` from 51.6.1 to 51.8.0
- [Release notes](https://github.com/vercel/vercel/releases)
- [Changelog](https://github.com/vercel/vercel/blob/main/packages/cli/CHANGELOG.md)
- [Commits](https://github.com/vercel/vercel/commits/[email protected]/packages/cli)

---
updated-dependencies:
- dependency-name: astro
  dependency-version: 6.1.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: astro-og-canvas
  dependency-version: 0.11.1
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: vercel
  dependency-version: 51.8.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <[email protected]>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Apr 20, 2026
@vercel
Copy link
Copy Markdown

vercel Bot commented Apr 20, 2026 •
edited
Loading

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
openresource-dev Ready Ready Preview, Comment Apr 20, 2026 7:47am

@julien-deramond julien-deramond changed the title chore(deps): bump the github-actions group with 3 updates chore(deps): bump dependencies with 3 updates Apr 20, 2026
@julien-deramond julien-deramond merged commit 2f171d3 into main Apr 20, 2026
4 checks passed
@julien-deramond julien-deramond deleted the dependabot/npm_and_yarn/github-actions-0a8d769afd branch April 20, 2026 11:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@julien-deramond julien-deramond julien-deramond approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@julien-deramond